Lateral movement

Lateral movement is the phase of an intrusion in which an attacker uses a foothold on one machine to reach others in the same network, usually with stolen credentials. MITRE ATT&CK tracks it as a dedicated tactic. On Windows the common techniques are Remote Desktop, SMB access to administrative shares, PsExec-style remote service creation, WMI, WinRM and PowerShell Remoting, and remotely created scheduled tasks or services.

Evidence is split between two machines, and a good investigation looks at both. On the source host you find traces of the outbound action: the client tools that were run, RDP client history, and logons made with explicit credentials. On the destination host you find the inbound side: Security logon events with a network or remote-interactive logon type, new services such as the one PsExec installs, new scheduled tasks, and processes spawned by WmiPrvSE.exe or wsmprovhost.exe.

The main sources are the Windows event logs, where a handful of event IDs (4624, 4648, 7045, 4698) carry most of the weight, and the RDP connection artifacts. Correlating timestamps, account names and source addresses across hosts lets you rebuild the path the attacker took. Because attackers often rely on built-in administration tools, lateral movement overlaps heavily with LOLBin abuse, and it frequently precedes the installation of persistence on the newly reached host.